WebDav - Continuous Username/Password Prompts

[alfrescolove]

I'm testing webdav and kerberos.  The authentication works.  However, every time I select/double click a file from the Windows webdav (My Network Places) interface, I am prompted to re-enter my username and password.  Any idea why this happens or any potential leads as to where I may look for a solution?

[afaust]

Are you using Kerberos SSO or just password based authentication backed by Kerberos at the Repository? If the latter is the case the behavior you experience is the correct one. once you open a file with another application that application has no knowledge of the prior authenticated session and has to re-authenticate you. In a SSO scenario it would use the credentials provided by the OS, but in the non-SSO scenario you -the user - will be asked again to provide the credentials.

Please verify if kerberos.authentication.sso.enabled=true is set. Post your alfesco-global.properties and kerberos-*.properties if unsure where to find that setting.

[alfresquiviris]

Hi Axel,

We are currently installing a 4.2e community version and we don't know if the user password prompt while editing office documents online is avoidable or if it's something we have to assume as a normal behavior.
Our environmmet is Kerberos auth (AD)+ ldap sync (AD +) SSO enabled + Sharepoint SSL + IE 10 + WIN 7 (SSO on share not working at the moment because we still need to login) + Alfresco running in Ubuntu Server.

Please could you clarify this point.

Thanks

[afaust]

Hello,

the user password prompt is avoidable for online edit if SSO and client security settings have been properly set up. It is difficult to remote-diagnose the concrete issues you may be having.

Regards
Axel

[alfresquiviris]

Hello,

Yes, after some testing I can confirm prompts while working with AD Kerberos + SSO are avoidable using IE 10, Firefox and Chrome.
I have configured this in alfresco running in a Windows 2008 computer (pending to try in a Ubuntu computer).

I followed the Alfresco One 4.2.0 admin guide and I must say the only thing I missed is any reference to the authentication chain kerberos in the Kerberos section.

And be careful! Usernames, spn, paths, etc are case sensitive!

Thanks

[alfrescolove]

AFaust, hmmm…I did not have the kerberos.authentication.sso.enabled set to true.  I'm trying to test this, Unfortunately, I cannot test until I find a desktop that allows editing of the Local Intranet > custom zones.

[alfrescolove]

You're right - enabling SSO worked.